Comments

On Wed, Jan 23, 2019 at 03:03:47AM -0800, Kees Cook wrote:
> Variables declared in a switch statement before any case statements> cannot be initialized, so move all instances out of the switches.> After this, future always-initialized stack variables will work> and not throw warnings like this:> > fs/fcntl.c: In function ‘send_sigio_to_task’:> fs/fcntl.c:738:13: warning: statement will never be executed [-Wswitch-unreachable]> siginfo_t si;> ^~
That's a pain, so this means we can't have any new variables in { }
scope except for at the top of a function?
That's going to be a hard thing to keep from happening over time, as
this is valid C :(
greg k-h

On Wed, Jan 23, 2019 at 1:04 PM Greg KH <gregkh@linuxfoundation.org> wrote:
> On Wed, Jan 23, 2019 at 03:03:47AM -0800, Kees Cook wrote:> > Variables declared in a switch statement before any case statements> > cannot be initialized, so move all instances out of the switches.> > After this, future always-initialized stack variables will work> > and not throw warnings like this:> >> > fs/fcntl.c: In function ‘send_sigio_to_task’:> > fs/fcntl.c:738:13: warning: statement will never be executed [-Wswitch-unreachable]> > siginfo_t si;> > ^~>> That's a pain, so this means we can't have any new variables in { }> scope except for at the top of a function?
AFAICS this only applies to switch statements (because they jump to a
case and don't execute stuff at the start of the block), not blocks
after if/while/... .
> That's going to be a hard thing to keep from happening over time, as> this is valid C :(

On Wed, 23 Jan 2019 at 13:09, Jann Horn <jannh@google.com> wrote:
>> On Wed, Jan 23, 2019 at 1:04 PM Greg KH <gregkh@linuxfoundation.org> wrote:> > On Wed, Jan 23, 2019 at 03:03:47AM -0800, Kees Cook wrote:> > > Variables declared in a switch statement before any case statements> > > cannot be initialized, so move all instances out of the switches.> > > After this, future always-initialized stack variables will work> > > and not throw warnings like this:> > >> > > fs/fcntl.c: In function ‘send_sigio_to_task’:> > > fs/fcntl.c:738:13: warning: statement will never be executed [-Wswitch-unreachable]> > > siginfo_t si;> > > ^~> >> > That's a pain, so this means we can't have any new variables in { }> > scope except for at the top of a function?>> AFAICS this only applies to switch statements (because they jump to a> case and don't execute stuff at the start of the block), not blocks> after if/while/... .>
I guess that means it may apply to other cases where you do a 'goto'
into the middle of a for() loop, for instance (at the first
iteration), which is also a valid pattern.
Is there any way to tag these assignments so the diagnostic disregards them?

> On Jan 23, 2019, at 5:09 AM, Jann Horn <jannh@google.com> wrote:> > AFAICS this only applies to switch statements (because they jump to a> case and don't execute stuff at the start of the block), not blocks> after if/while/... .
It bothers me that we are going out of our way to deprecate valid C constructs
in favor of placing the declarations elsewhere.
As current compiler warnings would catch any reference before initialization
usage anyway, it seems like we are letting a compiler warning rather than the
language standard dictate syntax.
Certainly if we want to make it a best practice coding style issue we can, and
then an appropriate note explaining why should be added to
Documentation/process/coding-style.rst.

On Wed, 23 Jan 2019, Greg KH <gregkh@linuxfoundation.org> wrote:
> On Wed, Jan 23, 2019 at 03:03:47AM -0800, Kees Cook wrote:>> Variables declared in a switch statement before any case statements>> cannot be initialized, so move all instances out of the switches.>> After this, future always-initialized stack variables will work>> and not throw warnings like this:>> >> fs/fcntl.c: In function ‘send_sigio_to_task’:>> fs/fcntl.c:738:13: warning: statement will never be executed [-Wswitch-unreachable]>> siginfo_t si;>> ^~>> That's a pain, so this means we can't have any new variables in { }> scope except for at the top of a function?>> That's going to be a hard thing to keep from happening over time, as> this is valid C :(
Not all valid C is meant to be used! ;)
Anyway, I think you're mistaking the limitation to arbitrary blocks
while it's only about the switch block IIUC.
Can't have:
switch (i) {
int j;
case 0:
/* ... */
}
because it can't be turned into:
switch (i) {
int j = 0; /* not valid C */
case 0:
/* ... */
}
but can have e.g.:
switch (i) {
case 0:
{
int j = 0;
/* ... */
}
}
I think Kees' approach of moving such variable declarations to the
enclosing block scope is better than adding another nesting block.
BR,
Jani.

On Wed, 23 Jan 2019, Jani Nikula <jani.nikula@linux.intel.com> wrote:
> On Wed, 23 Jan 2019, Greg KH <gregkh@linuxfoundation.org> wrote:> > On Wed, Jan 23, 2019 at 03:03:47AM -0800, Kees Cook wrote:> >> Variables declared in a switch statement before any case statements> >> cannot be initialized, so move all instances out of the switches.> >> After this, future always-initialized stack variables will work> >> and not throw warnings like this:> >>> >> fs/fcntl.c: In function ‘send_sigio_to_task’:> >> fs/fcntl.c:738:13: warning: statement will never be executed [-Wswitch-unreachable]> >> siginfo_t si;> >> ^~> >> > That's a pain, so this means we can't have any new variables in { }> > scope except for at the top of a function?> >> > That's going to be a hard thing to keep from happening over time, as> > this is valid C :(> > Not all valid C is meant to be used! ;)
Very true. The other thing to keep in mind is the burden of enforcing a prohibition on a valid C construct like this.
It seems to me that patch reviewers and maintainers have enough to do without forcing them to watch for variable
declarations in switch statements. Automating this prohibition, should it be accepted, seems like a good idea to me.
-Edwin Zimmerman

On Wed, 23 Jan 2019, Edwin Zimmerman <edwin@211mainstreet.net> wrote:
> On Wed, 23 Jan 2019, Jani Nikula <jani.nikula@linux.intel.com> wrote:>> On Wed, 23 Jan 2019, Greg KH <gregkh@linuxfoundation.org> wrote:>> > On Wed, Jan 23, 2019 at 03:03:47AM -0800, Kees Cook wrote:>> >> Variables declared in a switch statement before any case statements>> >> cannot be initialized, so move all instances out of the switches.>> >> After this, future always-initialized stack variables will work>> >> and not throw warnings like this:>> >>>> >> fs/fcntl.c: In function ‘send_sigio_to_task’:>> >> fs/fcntl.c:738:13: warning: statement will never be executed [-Wswitch-unreachable]>> >> siginfo_t si;>> >> ^~>> >>> > That's a pain, so this means we can't have any new variables in { }>> > scope except for at the top of a function?>> >>> > That's going to be a hard thing to keep from happening over time, as>> > this is valid C :(>> >> Not all valid C is meant to be used! ;)>> Very true. The other thing to keep in mind is the burden of enforcing> a prohibition on a valid C construct like this. It seems to me that> patch reviewers and maintainers have enough to do without forcing them> to watch for variable declarations in switch statements. Automating> this prohibition, should it be accepted, seems like a good idea to me.
Considering that the treewide diffstat to fix this is:
18 files changed, 45 insertions(+), 46 deletions(-)
and using the gcc plugin in question will trigger the switch-unreachable
warning, I think we're good. There'll probably be the occasional
declarations that pass through, and will get fixed afterwards.
BR,
Jani.

On Thu, Jan 24, 2019 at 4:44 AM Jani Nikula <jani.nikula@linux.intel.com> wrote:
>> On Wed, 23 Jan 2019, Edwin Zimmerman <edwin@211mainstreet.net> wrote:> > On Wed, 23 Jan 2019, Jani Nikula <jani.nikula@linux.intel.com> wrote:> >> On Wed, 23 Jan 2019, Greg KH <gregkh@linuxfoundation.org> wrote:> >> > On Wed, Jan 23, 2019 at 03:03:47AM -0800, Kees Cook wrote:> >> >> Variables declared in a switch statement before any case statements> >> >> cannot be initialized, so move all instances out of the switches.> >> >> After this, future always-initialized stack variables will work> >> >> and not throw warnings like this:> >> >>> >> >> fs/fcntl.c: In function ‘send_sigio_to_task’:> >> >> fs/fcntl.c:738:13: warning: statement will never be executed [-Wswitch-unreachable]> >> >> siginfo_t si;> >> >> ^~> >> >> >> > That's a pain, so this means we can't have any new variables in { }> >> > scope except for at the top of a function?
Just in case this wasn't clear: no, it's just the switch statement
before the first "case". I cannot imagine how bad it would be if we
couldn't have block-scoped variables! Heh. :)
> >> >> >> > That's going to be a hard thing to keep from happening over time, as> >> > this is valid C :(> >>> >> Not all valid C is meant to be used! ;)> >> > Very true. The other thing to keep in mind is the burden of enforcing> > a prohibition on a valid C construct like this. It seems to me that> > patch reviewers and maintainers have enough to do without forcing them> > to watch for variable declarations in switch statements. Automating> > this prohibition, should it be accepted, seems like a good idea to me.>> Considering that the treewide diffstat to fix this is:>> 18 files changed, 45 insertions(+), 46 deletions(-)>> and using the gcc plugin in question will trigger the switch-unreachable> warning, I think we're good. There'll probably be the occasional> declarations that pass through, and will get fixed afterwards.
Yeah, that was my thinking as well: it's a rare use, and we get a
warning when it comes up.
Thanks!